Detections Dashboard

Selecting Detections from the Dashboards menu displays the Detections dashboard, which summarizes and highlights the most important current and historical information for Detections from an overview perspective.

Time Range Dropdown – Specifies the time range of displayed data from the past 7 days to the past year.

SEVERITY dropdown filter– Limits displayed data to all or one of the following severity levels: Critical, High, Medium, Low.

IMPACT dropdown filter– Limits displayed data to all or one of the one of the five severity levels.

DISMISSAL REASONdropdown filter– Limits displayed data to all or one of the possible resolution reasons. Resolve reason definitions are provided here.

Detections by Severity - Detections grouped by severity.

Detection by Rule Type - Detections grouped by rule type (either Forescout Rule or Custom Rule).

Detections by Data Source - Displays Data Source throughput graphed against number of detections in bubble format. Forescout recommends a time range of 30 days to demonstrate a full picture of Data Source contributions to detections.

Top Malicious True Positive Detections - The top detections that were dismissed as malicious true positive. Up to 5 detections are listed.

Top Benign True Positive Detections - The top detections that were dismissed as benign true positive. Up to 5 detections are listed.

Top 5 False Positive Detections - The top detections that were dismissed as false positive. Up to 5 detections are listed.

MITRE ATT&CK Tactics Detected - Security Incident cases grouped by the case’s MITRE tactic(s). The case must have been created in the selected time range.

Detection Dismissal by Reason Code - Detections grouped by dismissal reason.

Detection by Rule Type – Detections grouped by rule type (either Forescout Rule or Custom Rule).

Top MITRE ATT&CK Techniques Detected - The top MITRE techniques from security incident cases. Up to 10 MITRE techniques are listed.

Health monitoring detections are excluded.

To be displayed the detection must have been created in the selected time range.

Report Scheduler

Clicking the Report Scheduler button displays a form to specify a report to be automatically generated and appended as a PDF to an email that is forwarded to recipients based on the following criteria:

  • SCHEDULER NAME – Specifies the name of the scheduled report.

  • DASHBOARDS– Specifies which dashboards will be included in the report.

  • SCHEDULE – Specifies whether the report should be run immediately, daily, weekly, or monthly.

  • RECIPIENTS – Specifies the recipients who will receive the report.

  • SUBJECT LINE (OPTIONAL) – Specifies an optional subject line for the report message.

  • MESSAGE (OPTIONAL) – Specifies a message for the report.